Win95.Yildiz源代码

最新推荐文章于 2024-09-07 09:47:48 发布

zhangjie0072

最新推荐文章于 2024-09-07 09:47:48 发布

阅读量1.5k

点赞数

分类专栏：病毒研究文章标签： file header buffer attributes generation api

本文链接：https://blog.youkuaiyun.com/zhangjie0072/article/details/768608

版权

Win95.Yildiz 是由 Black Jack 编写的直接作用型/全局 Ring3 居住 PE 头部空洞病毒。它利用未公开的 Win9X API VxDCall0 调用 int 21h，感染当前目录中的所有 PE EXE 文件，并在内存中感染 kernel32.dll。病毒通过创建临时文件并使用 int21h 读取只读内存来实现。该源代码旨在研究和教育目的，不支持病毒在野传播。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

NAME: Win95.Yildiz
AUTHOR: Black Jack [independant Austrian Win32asm virus coder]
CONTACT: Black_Jack_VX@hotmail.com | http://www.coderz.net/blackjack
TYPE: Win9x direct acting/global ring3 resident PE header cavity virus
SIZE: 323 bytes (but of course infected files won"t increase in size)

DESCRIPTION: When an infected file is run, the virus takes control. It then
　　　　　　 tries to find the kernel32 base address by a simple algorithm
　　　　　　 which should make it compatible with Win9X and WinME (although I
　　　　　　 haven"t tested it with the second one). After that it gets the
　　　　　　 undocumented Win9X API VxDCall0 and uses it to call int 21h. The
　　　　　　 VxDCall0 API is the very first exported API in Win9X; I don"t
　　　　　　 know which API is first in WinNT, that"s why unpredictable
　　　　　　 results may occur when the virus runs in that OS (I haven"t tried
　　　　　　 it out, but of course the virus can"t work in NT).
　　　　　　 Then it goes TSR (read more about this a bit later), and infects
　　　　　　 all PE EXE files in the current directory by overwriting the
　　　　　　 unused padding bytes in the PE header with the virus body.
　　　　　　 The memory residency consist in infecting kernel32.dll in memory.
　　　　　　 To do so, it creates a temporary file called "Yildiz." and writes
　　　　　　 the first 4KB of kernel32.dll there. Then this file is infected
　　　　　　 like any other PE file. And finally the content of the infected
　　　　　　 temp file is read back into kernel32 memory. Yep, you have read
　　　　　　 right, by using the int21h with VxDCall0 you can read from a file
　　　　　　 into read-only memory! (This trick was discovered by Murkry/IkX,
　　　　　　 read more about it in the comments to his Darkside virus source,
　　　　　　 published in Xine#3).
　　　　　　 As I have already said, the kernel32 is infected in memory just
　　　　　　 like any other file, this means the entry point is set to the
　　　　　　 virus, no APIs are hooked. As you should know, the entry point
　　　　　　 of a DLL is a init routine that is called whenever the DLL is
　　　　　　 loaded by a program. And since kernel32 is imported by all
　　　　　　 programs, this means for us that whenever a program is run (and
　　　　　　 kernel32 is mapped into the program"s address space), our virus
　　　　　　 will infect all PE EXE files in the directory of the program.